Create a one-time claim link for an API key
Mint a one-time claim link that carries api_key to another device (the QR
onboarding leg). The submitted key is resolved through the gate’s own verifier chain
and the caller must own it (or be admin) per the module’s ownership rule; the response
returns the claim token ONCE plus a fragment-carrier path (/login#claim=<token>)
and an expiry.
Accepted oracle (deliberate, not an oversight): an unresolvable key answers 400 and a
valid-but-not-yours key answers 403, so an authenticated caller can tell a live key
from garbage. This adds NO capability the /api/auth/me carve-out does not already
grant a caller holding a candidate key. The uniform-404 no-oracle rule governs the
unauthenticated EXCHANGE surface, never this authed creation.
Authorizations
Body
Response
Success.

